HC3: Lazaraus Group malware targets health systems' ManageEngine vulnerabilities

The Lazaraus Group, which Cisco Talus reported to be targeting internet backbone infrastructure and healthcare entities in Europe and the United States, evolved its MagicRAT malware and deployed the trojan within five days of the discovery of the vulnerability in ManageEngine products in January, the Health Sector Cybersecurity Coordination Center said.

WHY IT MATTERS

The Lazzarus Group can exploit the CVE-2022-47966 vulnerability – if the SAML single-sign-on is or ever has been enabled in the ManageEngine setup – and perform …